Skip to main content
sharris
sharris
New Member
September 19, 2024
Solved

Unable to add cluster to FortiManager using WAN interface

  • September 19, 2024
  • 3 replies
  • 1537 views

We recently moved a FortiGate cluster (60F running on 7.4.4b2662) to a new location and are now unable to re-add it to FortiManager (VM running y7.4.3b2487) using the new WAN interface IP receiving the generic "Probe failed" error. Nothing was changed at the time in the configuration of the FortiGate cluster other than the WAN interface IP and the default static route. FGM-Access is enabled on the interface. We have an active IPsec VPN tunnel between the site containing the FortiManager installation and the new location of the FortiGate cluster. The cluster was previously connected to FortiManager with no trouble at all and we are able to connect them now using the LAN interface IP over the VPN tunnel but using the WAN interface as was previously the case is the preferred method.

 

We have confirmed that the credentials being used are correct. Nothing in the firewall policy directly references the old WAN IP that I can find. As mentioned, we can add the cluster using the internal IP over the VPN tunnel but not using the WAN IP which implies it is not a problem with the global config on the device. Just to test we have tried setting the enc-algorithm to default, low, and high with no change in the result. We have compared the configurations of the problem cluster and other connected clusters and can't find any relevant differences.

 

I have been Googling my brains out trying to find a solution to this but am flummoxed. Does anyone have any ideas for where else I can look?

 

TIA

Best answer by sharris

After taking another look with fresh eyes I found the problem. There was a policy blocking the traffic from the FortiManager VM itself for all but a handful of objects. Once that was updated I was able to successfully add the cluster again.

3 replies

AEK
SuperUser
AEK
SuperUser
September 20, 2024

For security it is recommended to avoid any management access on WAN interface.

The management through the VPN tunnel is much preferred.

AEK
sharris
sharrisAuthor
New Member
September 20, 2024

I appreciate the feedback and am aware of the recommendation but I am not the one who makes these decisions and your response does not address my actual question.

sharris
sharrisAuthorAnswer
New Member
September 20, 2024

After taking another look with fresh eyes I found the problem. There was a policy blocking the traffic from the FortiManager VM itself for all but a handful of objects. Once that was updated I was able to successfully add the cluster again.

Jayecho
Jayecho
New Member
July 2, 2025

Check if the new WAN IP is allowed in FortiManager trusted hosts. Also, make sure any ISP or external firewall is not blocking ports needed by FortiManager. Try a packet capture on the WAN interface to see if traffic is reaching the FortiGate. This may help you find where the problem is.

Terms & ConditionsAccessibility statement